DCF Warns Child Care Workers of Possible Computer Security Breach
The Department of Children and Families, in Volusia County, was forced to send out letters to 100,000 child care workers state wide due to the possibility of a security breach. The letters urged employees to put fraud alerts on their credit reports so that they would be notified if any fraudulent activity occurred. DCF requires Florida daycare workers to get background checks. The workers must provide all their personal information including their dates of birth and social security numbers. DCF uses a third party to store the personal information. That vendor stored the information on the internet, but did not password protect it. Even though it wasn’t easily accessible on any search engines, anyone had access to it because it was not password protected.
DCF failed to meet the security goal of confidentiality. Anyone was able to read this sensitive information. This possible security breach could have been very easily avoided. The vendor DCF used to store these employees’ personal information failed to have any access controls over this sensitive information. The simple use of a password would have provided an access control over this information. It is also important to have a strong password policies to help stop hackers from taking advantages of the inherent weaknesses associated with using passwords. Password policies should require the frequent changing of passwords, perhaps every 90 days. No shared accounts should be allowed and each employee should have their own username and password. Anyone that leaves the organization should have their password immediately disabled. Passwords should be required to be strong by requiring employees to use passwords that are at least eight characters long. The password should also have at least one change of case, but not at the beginning. And have at least one digit and one non-alphanumeric character, neither at the end. However, due to the nature of the information a two-factor authentication promises defense in depth. This works by still protecting the information even if one authentication method is broken by an imposter. It’s not perfect and does have weaknesses against Trojan horses and man-in-the-middle attacks.
Article #2:
JPL Computers Hacked Repeatedly in 2010 and 2011, NASA Report Says
According to a federal report, hackers have repeatedly penetrated NASA computers. The hackers have stolen user information from many employees and have gained control over key networks at the Jet Propulsion Laboratory in La Canada Flintridge. NASA Inspector General Paul K. Martin noted that between 2010 and 2011 the agency reported 5,408 computer security breaches. The breaches resulted in the spread of destructive software or unauthorized access to computer systems. The inspector general also stated that NASA was victimized 47 times in 2011by sophisticated hackers from well-founded sources trying to steal or modify computers without detection. The intruders were successful and “gained full access to key JPL systems and sensitive user accounts.” The hackers were then able to alter files, user accounts, and upload tools to steal user credentials. Basically, the hackers were able to gain full functional control over JPL’s network. The attacks are coming from all over the world including China, Italy, Estonia, Great Britain, Nigeria, Portugal, Romania, and Turkey.
NASA has been slow to implement preventative countermeasures to keep attacks from succeeding. NASA also needs to have detective countermeasures in place to identify when a treat is attacking and especially when it is succeeding. Fast detection can minimize damage. NASA needs to ensure that when their information is stolen that the hackers cannot read it. This can be accomplished through cryptography. Cryptography uses mathematical operations to protect messages traveling between parties or stored on the computer. One way to implement cryptography is through encryption. Encryption is the process of changing plaintext into ciphertext for the purpose of security or privacy. Ciphertext cannot be read by the hackers that intercept it. Cryptographic protections are rarely used alone. They should be packaged in a cryptographic system to ensure a full range of protection. This is especially important to NASA’s laptops and mobile devices. NASA also needs a strong firewall to prevent attack packets from getting into the network. NASA should also have an intrusion detection system. This system will provide deep packet inspection and examine streams of packets instead of just individual packets. The IDS will not stop the packets, but will look for suspicious packets and report them. The IDS would help NASA with their detective countermeasures. NASA should also be using either mandatory access control or discretionary access control to further strengthen their security.
DCF Warns Child Care Workers of Possible Computer Security Breach
The Department of Children and Families, in Volusia County, was forced to send out letters to 100,000 child care workers state wide due to the possibility of a security breach. The letters urged employees to put fraud alerts on their credit reports so that they would be notified if any fraudulent activity occurred. DCF requires Florida daycare workers to get background checks. The workers must provide all their personal information including their dates of birth and social security numbers. DCF uses a third party to store the personal information. That vendor stored the information on the internet, but did not password protect it. Even though it wasn’t easily accessible on any search engines, anyone had access to it because it was not password protected.
DCF failed to meet the security goal of confidentiality. Anyone was able to read this sensitive information. This possible security breach could have been very easily avoided. The vendor DCF used to store these employees’ personal information failed to have any access controls over this sensitive information. The simple use of a password would have provided an access control over this information. It is also important to have a strong password policies to help stop hackers from taking advantages of the inherent weaknesses associated with using passwords. Password policies should require the frequent changing of passwords, perhaps every 90 days. No shared accounts should be allowed and each employee should have their own username and password. Anyone that leaves the organization should have their password immediately disabled. Passwords should be required to be strong by requiring employees to use passwords that are at least eight characters long. The password should also have at least one change of case, but not at the beginning. And have at least one digit and one non-alphanumeric character, neither at the end. However, due to the nature of the information a two-factor authentication promises defense in depth. This works by still protecting the information even if one authentication method is broken by an imposter. It’s not perfect and does have weaknesses against Trojan horses and man-in-the-middle attacks.
Article #2:
JPL Computers Hacked Repeatedly in 2010 and 2011, NASA Report Says
According to a federal report, hackers have repeatedly penetrated NASA computers. The hackers have stolen user information from many employees and have gained control over key networks at the Jet Propulsion Laboratory in La Canada Flintridge. NASA Inspector General Paul K. Martin noted that between 2010 and 2011 the agency reported 5,408 computer security breaches. The breaches resulted in the spread of destructive software or unauthorized access to computer systems. The inspector general also stated that NASA was victimized 47 times in 2011by sophisticated hackers from well-founded sources trying to steal or modify computers without detection. The intruders were successful and “gained full access to key JPL systems and sensitive user accounts.” The hackers were then able to alter files, user accounts, and upload tools to steal user credentials. Basically, the hackers were able to gain full functional control over JPL’s network. The attacks are coming from all over the world including China, Italy, Estonia, Great Britain, Nigeria, Portugal, Romania, and Turkey.
NASA has been slow to implement preventative countermeasures to keep attacks from succeeding. NASA also needs to have detective countermeasures in place to identify when a treat is attacking and especially when it is succeeding. Fast detection can minimize damage. NASA needs to ensure that when their information is stolen that the hackers cannot read it. This can be accomplished through cryptography. Cryptography uses mathematical operations to protect messages traveling between parties or stored on the computer. One way to implement cryptography is through encryption. Encryption is the process of changing plaintext into ciphertext for the purpose of security or privacy. Ciphertext cannot be read by the hackers that intercept it. Cryptographic protections are rarely used alone. They should be packaged in a cryptographic system to ensure a full range of protection. This is especially important to NASA’s laptops and mobile devices. NASA also needs a strong firewall to prevent attack packets from getting into the network. NASA should also have an intrusion detection system. This system will provide deep packet inspection and examine streams of packets instead of just individual packets. The IDS will not stop the packets, but will look for suspicious packets and report them. The IDS would help NASA with their detective countermeasures. NASA should also be using either mandatory access control or discretionary access control to further strengthen their security.
50/50